Skip to main content

Connecting to SNYK

Overview:

Snyk (pronounced sneak) is a developer security platform for securing code, dependencies, containers, and infrastructure as code.

Snyk tests for vulnerabilities in your own code, open-source dependencies, Container images, and Infrastructure as Code (IaC) configurations, and offers context, prioritization, and fixes.

Snyk reporting acts as a Bill of Materials (BOM) to quickly and easily identify which projects have a specific version of a dependency. Dependency reports identify each individual open-source dependency by name, along with version, vulnerabilities, and related projects.

Snyk uses CVSS framework version 3.1 to communicate the characteristics and severity of vulnerabilities.

 

Steps

At a high level here are the steps you will need to complete to make the connection between ControlMap and 

Snyk.

1. Add a project to your Snyk account.

2. List out all vulnerability scanned by Snyk.

3. Obtain API Token, Organization Id, Project Id from Snyk.

 

Step 1: Add a project to your Snyk account.

1. Login to your Snyk account using https://app.snyk.io.

2. Go to Project tabs.

KZCzOOpW5u_SarNAa4dZNeS7XkI5zRc3Tw.png

3. Click on Add Project button on top right side.

4. Select a cloud repository location where your project is.

52NDjULIUO8Gj0C9UYR9ngjqbNLLHvUgUA.png

5. After clicking any of the cloud repository. Select repository to be scanned  (let’s say you clicked bitbucket and selected any repository the following page will appear).

1wdKax-vnBeOqXQ2yt2GHd-Z4G82OlAOqw.png

6. Click on Add selected repository present at top right of screen.

 

 

 

 

Step 2: List out all vulnerability scanned by Snyk

  1. After step 1, Click on Projects tab.

 

xJHiqg0EBVbJH7vm13v3KdkQUcC4f9MH7w.png

Page will look like this.

fumfiU9At7lx4uNyYLwtJQfREaLoLgqGKA.png

 

 

  1. Expand the target repository and select pom.xml file.

 

Following page will appear with SEVERITY levels.

QzZ80q-B8HvYGQaXeXX6KYNEKi_ja9T7Mw.png

 

 

 

 

 

 

  1. Obtain API Token, Organization Id, Project Id from Snyk

 

1.  For API Token

a) Click on profile button on top right of screen.

yZGuaxVcR4sNvy1wh9AVuB8i3NCKSp9Sxw.png

 

 

 

b) After click on account settings you will get following screen.

qxUKYAvpTcFo5S_Ybx7hlrfTHbM1T86pNw.png

 

      2) For Project Id:

        a) Click on org setting on menu bar.

RcBLDqICnCMdlmsEnSvgrnlDYuLvfgTYBQ.png

 

      b) Following page will appear. Please note down the Organization Id.

 

zyYhcJTGBEU5WlEvbaws6s4xsb5Het-6qQ.png

 

 

 

 

 

 

3) For Project Id:

        a) Go to Projects tab.

 

C_JbG07H36d0Ibl80C4z_03o73fR_U_jBg.png

Page will look like this.

VEG52znzoRYbhgzAsNkqcnzKF-4y0D8EUA.png

 

            b) Expand the expand repository and select pom.xml file.

 

yRxZ9U3fkEQT9-J7EvlE74k1ZJCs7Nr6Gw.png

 

 

c) Click on setting from right side.

 

OJgTUtnKEzauqZv-epSNLqnCI1KO1ljPgw.png

 

 

d) Note down the Project Id from here.

 

2CknrnGVWdpVWLLTO73sxVaq7xfOQxkF6Q.png